Skip to main content
Nelo is a hackathon project built against a four-week plan. This page is the honest ledger of where it actually is.
Three states are kept apart, because conflating them is how a demo ends up claiming something untrue:
  • Proven — a test that has actually executed, or a run on devnet
  • Written — code exists and compiles, but has never run
  • Declared stub — deliberately not real, and labelled as such at every call site

​
Where it stands

The trust model

Proven, on devnet. Vault, voucher redemption with the signature verified by the precompile on a real validator, 128-slot replay window, timelocked withdrawal, conflict freeze, double-spend refused.Caveat: run with a software P-256 key, not StrongBox.

The ordinary sale

Written, and typechecked. Till, MWA wallet, Solana Pay, payment validation, day-book, balance, SPL collateral, onboarding.Caveat: never rendered. A dev-client build compiles the native side but does not embed the JS.

Trust Stake

Proven, on devnet. 17 curve tests off chain, ~19 on chain in LiteSVM, and RiskConfig now live on a real validator with redeem_voucher exercised against its new account struct.

Settlement

Ledger proven (39 tests) — double-entry, idempotent, reversible, reconcilable. Partner is a declared stub.

​
By component

​
The three things that block the most

1

Run the app on a handset

The one that blocks the most, now that the chain side is settled. The native build compiles, but a development client loads its JS from Metro — so nothing in either app has rendered. Every screen, every state transition and every native call is unverified at runtime.It answers three questions at once: does the JS bundle, does StrongBox behave on real hardware, and does MWA find a wallet.
2

Get a Privy app ID

Onboarding’s done-when is setup completed without ever seeing a key, and it cannot be demonstrated without one. The flow’s rules are tested; the SDK calls are typechecked and unexecuted. A build with no app ID runs and simply does not offer the phone route.
3

Settle the payout partner

No licensed partner has been signed. The ledger is real and the stub is honest, so the fork is cheap — but the real leg cannot be built against an API nobody has access to.

​
Decisions waiting on a person

Pyth publishes no NGN feed — 39 FX pairs, and the naira is not among them. Of the markets the plan names, Manila (PHP) is covered; Lagos is not.Either pick a covered launch currency, or source NGN from Switchboard or a commercial feed. Hermes also requires an API key for prices. Until one is settled, the till runs a configured rate and says so on screen.
The reserve model finds the 0.20% insurance line does not cover expected loss — 28.1 bps implied — and that reserve relief funds a premium of ~1.001×, not the illustrative 1.5×.Both are changes to documents and one constant, not to the architecture. Both should be settled before the deck goes out.
The curve raises required reserve below ~250ofstakedvalue,andthe250 of staked value, and the 500 hard cap needs $81,000 of stake to bind. Neither parameter can be fixed without the other.Both are RiskConfig updates rather than redeploys.
report_conflict only freezes on two vouchers at the same sequence. Successive sequences with inconsistent remaining_after do not trigger it, and that residual is what the insurance line prices.Accepting that pair as proof would shorten the window a compromised device keeps trading in. It changes the fraud model, so it is flagged rather than taken.

​
What is deliberately not built

Named rather than discovered, because a named stub reads as confidence and a discovered one reads as spin:
  • Slashing. The freeze blocks the exit, so stake cannot walk away from a loss it backs — but nothing yet moves it to a reserve, because there is no reserve account. That is the other half of “first-loss capital”.
  • The payout partner adapter. The interface exists; the implementation waits on sandbox access.
  • An HTTP surface on settle. It is a library the relay and the app will call, not a server.
  • Embedded-wallet recovery. needs-recovery is detected and reported; useRecoverEmbeddedWallet is not wired, so the retry on that screen will not clear it. It arises when a wallet has to be reconstructed on a new device, which is exactly the case a merchant who changes phones hits — so it is a gap with a date on it, not a permanent omission.
  • The offline transport. QR and NFC, cached enrolment and revocation lists, the offline queue — all week-3 work.